@astrale-os/sdk 0.6.0-beta.4 → 0.6.0-beta.41

package/dist/execution/identity/callback.d.ts

@@ -1,4 +1,5 @@
-import type { IssuerId, UnresolvedIdentityExpr, VerifiedCredential } from '../../platform/auth/index.js';
+import type { IssuerId, UnresolvedIdentityExpr } from '../../platform/auth/index.js';
+import type { NodeId } from '../../platform/graph/node/index.js';
 import type { SigningMaterial } from './signing.js';
 export declare const maximumCallbackTtlSeconds = 120;
 export declare const maximumCallbackDelegationTtlSeconds = 60;
@@ -7,8 +8,13 @@ export interface SignedCallback {
     readonly expiresAt: number;
     readonly delegateTtlSeconds: number;
 }
-export type CallbackGrantMode = 'caller' | 'self' | 'union';
-/** Exact callback Grant expressions corresponding to the Kernel Domain graph modes. */
+export type CallbackMode = 'caller' | 'self';
+/** The Domain's own authority, independent of any caller. */
+export declare const selfIdentity: Readonly<{
+    kind: 'identity';
+    self: true;
+}>;
+/** Exact single-identity callback authority for each Kernel Domain graph mode. */
 export declare function callbackIdentities(nested: string | Uint8Array): Readonly<{
     caller: Readonly<{
         kind: 'identity';
@@ -18,27 +24,21 @@ export declare function callbackIdentities(nested: string | Uint8Array): Readonl
         kind: 'identity';
         self: true;
     }>;
-    union: Readonly<{
-        kind: 'union';
-        operands: readonly (Readonly<{
-            kind: 'identity';
-            credential: string | Uint8Array<ArrayBufferLike>;
-        }> | Readonly<{
-            kind: 'identity';
-            self: true;
-        }>)[];
-    }>;
 }>;
 export declare function signDomainCallback(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, execution: {
     readonly deadline: number;
     readonly signal: AbortSignal;
 }): Promise<string>;
-export declare function signCallback(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential, execution: {
-    readonly deadline: number;
-    readonly signal: AbortSignal;
-}): Promise<string>;
-/** Reuse one exact callback authority partition, refreshing only near its bounded expiry. */
-export declare function createCallbackCredentialResolver(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential, execution: {
+/**
+ * Reuse one exact callback authority partition, refreshing only near its bounded expiry. No callback
+ * outlives `validUntil`, the earliest expiry in Unix seconds of the credentials it derives from: the
+ * Kernel folds each of them into the callback's validity, so a longer callback could not carry its
+ * delegation. Without it the callback is the Domain's own authority, bounded by the execution alone.
+ * Once that authority can no longer carry a callback, the call ends as DEADLINE_EXCEEDED. An
+ * `executionId` is the durable Execution a step's executor credential names in `EXECUTION_CLAIM`;
+ * no caller-bound callback names one.
+ */
+export declare function createCallbackCredentialResolver(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, validUntil: number | undefined, execution: {
     readonly deadline: number;
     readonly signal: AbortSignal;
-}): (signal: AbortSignal) => Promise<SignedCallback>;
+}, executionId?: NodeId): (signal: AbortSignal) => Promise<SignedCallback>;

package/dist/execution/identity/callback.js

@@ -1,32 +1,33 @@
+import { EXECUTION_CLAIM } from '@astrale-os/kernel-protocol/issuer/claims';
 import { SignJWT } from 'jose';
 import { protocolError } from '../invocation/result/index.js';
 import { requireLive } from './errors.js';
 export const maximumCallbackTtlSeconds = 120;
 export const maximumCallbackDelegationTtlSeconds = 60;
 const CALLBACK_DELEGATION_SKEW_SECONDS = 5;
-/** Exact callback Grant expressions corresponding to the Kernel Domain graph modes. */
+/** The Domain's own authority, independent of any caller. */
+export const selfIdentity = Object.freeze({ kind: 'identity', self: true });
+/** Exact single-identity callback authority for each Kernel Domain graph mode. */
 export function callbackIdentities(nested) {
-    const caller = Object.freeze({ kind: 'identity', credential: nested });
-    const self = Object.freeze({ kind: 'identity', self: true });
     return Object.freeze({
-        caller,
-        self,
-        union: Object.freeze({
-            kind: 'union',
-            operands: Object.freeze([self, caller]),
-        }),
+        caller: Object.freeze({ kind: 'identity', credential: nested }),
+        self: selfIdentity,
     });
 }
 export async function signDomainCallback(signing, issuer, subject, audience, execution) {
-    return (await sign(signing, issuer, subject, audience, { kind: 'identity', self: true }, execution)).credential;
+    return (await sign(signing, issuer, subject, audience, selfIdentity, execution)).credential;
 }
-export async function signCallback(signing, issuer, subject, audience, expression, carrier, execution) {
-    const maximum = carrier.exp ?? Number.POSITIVE_INFINITY;
-    return (await sign(signing, issuer, subject, audience, expression, execution, maximum)).credential;
-}
-/** Reuse one exact callback authority partition, refreshing only near its bounded expiry. */
-export function createCallbackCredentialResolver(signing, issuer, subject, audience, expression, carrier, execution) {
-    const maximum = carrier.exp ?? Number.POSITIVE_INFINITY;
+/**
+ * Reuse one exact callback authority partition, refreshing only near its bounded expiry. No callback
+ * outlives `validUntil`, the earliest expiry in Unix seconds of the credentials it derives from: the
+ * Kernel folds each of them into the callback's validity, so a longer callback could not carry its
+ * delegation. Without it the callback is the Domain's own authority, bounded by the execution alone.
+ * Once that authority can no longer carry a callback, the call ends as DEADLINE_EXCEEDED. An
+ * `executionId` is the durable Execution a step's executor credential names in `EXECUTION_CLAIM`;
+ * no caller-bound callback names one.
+ */
+export function createCallbackCredentialResolver(signing, issuer, subject, audience, expression, validUntil, execution, executionId) {
+    const maximum = validUntil ?? Number.POSITIVE_INFINITY;
     let cached;
     let pending;
     return async (signal) => {
@@ -38,11 +39,10 @@ export function createCallbackCredentialResolver(signing, issuer, subject, audie
             return cached;
         }
         if (pending === undefined) {
-            const current = sign(signing, issuer, subject, audience, expression, execution, maximum).then((signed) => {
+            const current = sign(signing, issuer, subject, audience, expression, execution, maximum, executionId).then((signed) => {
                 const delegateTtlSeconds = Math.min(maximumCallbackDelegationTtlSeconds, signed.expiresAt - signed.issuedAt - CALLBACK_DELEGATION_SKEW_SECONDS);
-                if (delegateTtlSeconds < 1) {
-                    throw protocolError('AUTH_INVALID', 'Credential is invalid.');
-                }
+                if (delegateTtlSeconds < 1)
+                    throw exhausted(execution, maximum);
                 return (cached = Object.freeze({
                     credential: signed.credential,
                     expiresAt: signed.expiresAt,
@@ -61,16 +61,18 @@ export function createCallbackCredentialResolver(signing, issuer, subject, audie
         return withSignal(pending, signal);
     };
 }
-async function sign(signing, issuer, subject, audience, expression, execution, maximum = Number.POSITIVE_INFINITY) {
+async function sign(signing, issuer, subject, audience, expression, execution, maximum = Number.POSITIVE_INFINITY, executionId) {
     requireLive(execution);
     const privateKey = await withSignal(signing.privateKey, execution.signal);
     requireLive(execution);
     const now = Math.floor(Date.now() / 1_000);
     const expiresAt = Math.min(maximum, Math.floor(execution.deadline / 1_000), now + maximumCallbackTtlSeconds);
-    if (!Number.isFinite(expiresAt) || expiresAt <= now) {
-        throw protocolError('AUTH_INVALID', 'Credential is invalid.');
-    }
-    const credential = await withSignal(new SignJWT({ grant: { v: 1, expr: expression } })
+    if (!Number.isFinite(expiresAt) || expiresAt <= now)
+        throw exhausted(execution, maximum);
+    const credential = await withSignal(new SignJWT({
+        grant: { v: 1, expr: expression },
+        ...(executionId === undefined ? {} : { [EXECUTION_CLAIM]: executionId }),
+    })
         .setProtectedHeader({
         alg: signing.algorithm,
         ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
@@ -84,6 +86,12 @@ async function sign(signing, issuer, subject, audience, expression, execution, m
     requireLive(execution);
     return Object.freeze({ credential, issuedAt: now, expiresAt });
 }
+/** The authority a callback derives from ends before the callback could serve a call. */
+function exhausted(execution, maximum) {
+    return protocolError('DEADLINE_EXCEEDED', maximum * 1_000 < execution.deadline
+        ? 'Caller authority has expired.'
+        : 'Invocation deadline was exceeded.');
+}
 function withSignal(operation, signal) {
     if (signal.aborted)
         return Promise.reject(signal.reason);

package/dist/execution/identity/delivery.d.ts

@@ -1,6 +1,8 @@
-import type { publication as serverPublication } from '@astrale-os/kernel-server';
-import * as publication from '@astrale-os/kernel-protocol/publication';
+import type { release as serverRelease } from '@astrale-os/kernel-server';
+import * as release from '@astrale-os/kernel-protocol/release';
 import type { IssuerId } from '../../platform/auth/index.js';
 import type { SigningMaterial } from './signing.js';
-/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
-export declare function publicationDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: publication.Publication): serverPublication.delivery.Provider;
+/**
+ * Create one stateless, nonce-bound public Delivery v2 provider for the exact deployment release.
+ */
+export declare function releaseDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: release.DomainRelease): serverRelease.delivery.Provider;

package/dist/execution/identity/delivery.js

@@ -1,34 +1,39 @@
-import * as publication from '@astrale-os/kernel-protocol/publication';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { SignJWT } from 'jose';
 const ATTESTATION_TTL_SECONDS = 60;
-/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
-export function publicationDelivery(signing, issuer, subject, deployed) {
+/**
+ * Create one stateless, nonce-bound public Delivery v2 provider for the exact deployment release.
+ */
+export function releaseDelivery(signing, issuer, subject, deployed) {
     return Object.freeze({
         async create(request, context) {
             context.signal.throwIfAborted();
-            const now = Math.floor(Date.now() / 1_000);
-            const attestation = await new SignJWT({
-                purpose: publication.delivery.PURPOSE,
+            const attestation = await attest(signing, issuer, subject, request.kernel, {
+                purpose: release.delivery.PURPOSE,
                 nonce: request.nonce,
-                etag: deployed.etag,
+                release: deployed.digest,
                 schemaRevision: deployed.schema.revision,
-            })
-                .setProtectedHeader({
-                alg: signing.algorithm,
-                ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
-            })
-                .setIssuer(issuer)
-                .setSubject(subject)
-                .setAudience(request.kernel)
-                .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
-                .sign(await signing.privateKey);
+            });
             context.signal.throwIfAborted();
-            return publication.delivery.accept({
+            return release.delivery.accept({
                 format: 'astrale.domain.delivery',
-                version: 1,
-                publication: deployed,
+                version: 2,
+                release: deployed,
                 attestation,
             });
         },
     });
 }
+async function attest(signing, issuer, subject, kernel, claims) {
+    const now = Math.floor(Date.now() / 1_000);
+    return new SignJWT(claims)
+        .setProtectedHeader({
+        alg: signing.algorithm,
+        ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+    })
+        .setIssuer(issuer)
+        .setSubject(subject)
+        .setAudience(kernel)
+        .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
+        .sign(await signing.privateKey);
+}

package/dist/execution/identity/identity.d.ts

@@ -1,7 +1,9 @@
 import type { Fetch } from '@astrale-os/kernel-client';
-import type * as publicationProtocol from '@astrale-os/kernel-protocol/publication';
-import type { Issuer, exchange, publication } from '@astrale-os/kernel-server';
+import type * as releaseProtocol from '@astrale-os/kernel-protocol/release';
+import type { Issuer, exchange, release } from '@astrale-os/kernel-server';
 import type { IssuerId, JsonWebKey } from '../../platform/auth/index.js';
+import type { ClientSession } from '../../platform/client/session/index.js';
+import type { NodeId } from '../../platform/graph/node/index.js';
 import type { InvocationAuthority } from '../invocation/index.js';
 import type { ExchangeOptions } from './exchange.js';
 import type { IdentityNetworkPolicy } from './jwks.js';
@@ -9,7 +11,19 @@ import type { IdentityNetworkPolicy } from './jwks.js';
 export interface Identity extends Issuer, InvocationAuthority {
     readonly subject: string;
     readonly tokenExchange?: exchange.Provider;
-    delivery(publication: publicationProtocol.Publication): publication.delivery.Provider;
+    /**
+     * Delivery v2 for the exact release this deployment serves.
+     */
+    delivery(served: releaseProtocol.DomainRelease): release.delivery.Provider;
+    /**
+     * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`
+     * (`ctx.execution.id`), which no caller credential carries; its credentials name `executionId` in
+     * `EXECUTION_CLAIM`. Required to serve durable Workflows; the caller closes the Session.
+     */
+    executor?(kernel: IssuerId, executionId: NodeId, execution: {
+        readonly deadline: number;
+        readonly signal: AbortSignal;
+    }): ClientSession;
 }
 export interface IdentityInput extends IdentityNetworkPolicy {
     readonly issuer: IssuerId;

package/dist/execution/identity/identity.js

@@ -1,5 +1,5 @@
-import { admit, authenticate } from './authentication.js';
-import { publicationDelivery } from './delivery.js';
+import { admit, authenticate, executorSession, selfInvocation } from './authentication.js';
+import { releaseDelivery } from './delivery.js';
 import { httpIssuer } from './errors.js';
 import { maximumExchangeTtl, tokenExchange } from './exchange.js';
 import { createVerificationBasisResolver } from './jwks.js';
@@ -49,9 +49,11 @@ export function createIdentity(input) {
             ? {}
             : { loadIssuerPublicKeys: input.loadIssuerPublicKeys }),
         ...(exchangeProvider === undefined ? {} : { tokenExchange: exchangeProvider }),
-        delivery: (publication) => publicationDelivery(material, issuer, input.subject, publication),
+        delivery: (served) => releaseDelivery(material, issuer, input.subject, served),
         admit: (request) => admit(request, configuration),
+        executor: (kernel, executionId, execution) => executorSession(kernel, executionId, execution, configuration),
         authenticate: (request) => authenticate(request.credential, request.via.issuer, request.context.execution, configuration),
+        self: async (request) => selfInvocation(request.via.issuer, request.context.execution, configuration),
     });
 }
 export function identity(input) {
@@ -67,6 +69,8 @@ export function identity(input) {
         'delivery',
         'admit',
         'authenticate',
+        'self',
+        'executor',
     ]);
     if (Reflect.ownKeys(input).some((key) => !allowed.has(key)) ||
         typeof input.subject !== 'string' ||
@@ -74,7 +78,9 @@ export function identity(input) {
         typeof input.loadPublicKeys !== 'function' ||
         typeof input.delivery !== 'function' ||
         typeof input.admit !== 'function' ||
-        typeof input.authenticate !== 'function') {
+        typeof input.authenticate !== 'function' ||
+        typeof input.self !== 'function' ||
+        (input.executor !== undefined && typeof input.executor !== 'function')) {
         invalid();
     }
     const receiver = Object.freeze({ ...input });
@@ -92,6 +98,8 @@ export function identity(input) {
         delivery: receiver.delivery.bind(receiver),
         admit: receiver.admit.bind(receiver),
         authenticate: receiver.authenticate.bind(receiver),
+        self: receiver.self.bind(receiver),
+        ...(receiver.executor === undefined ? {} : { executor: receiver.executor.bind(receiver) }),
     });
 }
 function invalid() {

package/dist/execution/identity/jwks.d.ts

@@ -16,6 +16,11 @@ export interface VerificationBasisResolver {
 /**
  * Retain only recently admitted public issuer material for one execution Identity.
  * An unseen key ID may refresh once per cooldown; failures never replace a usable basis.
+ *
+ * Callers share admitted bases, never a discovery in flight: each refresh runs on its own caller's
+ * fetch and signal. A Worker binds a subrequest to the request that started it and, once that
+ * request is cancelled, never settles it, so a shared refresh would hold every later caller of the
+ * issuer until its own deadline, for as long as the isolate lives.
  */
 export declare function createVerificationBasisResolver(fetch: Fetch, policy: IdentityNetworkPolicy, now?: () => number): VerificationBasisResolver;
 export declare function verifyCredential(input: CredentialInput, audience: IssuerId, bases: VerificationBasisResolver, signal: AbortSignal, policy: IdentityNetworkPolicy): Promise<{

package/dist/execution/identity/jwks.js

@@ -8,13 +8,37 @@ const MAXIMUM_DISCOVERY_BYTES = 256 * 1024;
 const MAXIMUM_VERIFICATION_BASES = 64;
 const VERIFICATION_BASIS_TTL_MS = 60_000;
 const UNKNOWN_KEY_REFRESH_COOLDOWN_MS = 60_000;
+const DISCOVERY_RETRY_DELAY_MS = 250;
+// Only typed transport failures are replayable. Browser TypeError, TLS, HTTP and document
+// admission failures carry no evidence that repeating the request can safely recover.
+const TRANSIENT_TRANSPORT_CODES = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ECONNRESET',
+    'ETIMEDOUT',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_SOCKET',
+]);
 /**
  * Retain only recently admitted public issuer material for one execution Identity.
  * An unseen key ID may refresh once per cooldown; failures never replace a usable basis.
+ *
+ * Callers share admitted bases, never a discovery in flight: each refresh runs on its own caller's
+ * fetch and signal. A Worker binds a subrequest to the request that started it and, once that
+ * request is cancelled, never settles it, so a shared refresh would hold every later caller of the
+ * issuer until its own deadline, for as long as the isolate lives.
  */
 export function createVerificationBasisResolver(fetch, policy, now = Date.now) {
     const bases = new Map();
-    const pending = new Map();
+    const retain = (issuer, entry) => {
+        if (bases.size >= MAXIMUM_VERIFICATION_BASES && !bases.has(issuer)) {
+            const oldest = bases.keys().next().value;
+            if (oldest !== undefined)
+                bases.delete(oldest);
+        }
+        bases.delete(issuer);
+        bases.set(issuer, Object.freeze(entry));
+    };
     return Object.freeze({
         async resolve(issuer, keyId, signal) {
             signal.throwIfAborted();
@@ -27,66 +51,33 @@ export function createVerificationBasisResolver(fetch, policy, now = Date.now) {
             const unknownKeyCooldown = cached?.unknownKeyRefreshedAt !== undefined &&
                 observedAt - cached.unknownKeyRefreshedAt >= 0 &&
                 observedAt - cached.unknownKeyRefreshedAt < UNKNOWN_KEY_REFRESH_COOLDOWN_MS;
-            if (fresh && knownKey) {
-                bases.delete(issuer);
-                bases.set(issuer, cached);
+            if (fresh && (knownKey || unknownKeyCooldown)) {
+                retain(issuer, cached);
                 return cached.basis;
             }
             const unknownKeyRefresh = cached !== undefined && !knownKey;
-            let refresh = pending.get(issuer);
-            if (refresh === undefined && fresh && unknownKeyCooldown) {
-                bases.delete(issuer);
-                bases.set(issuer, cached);
-                return cached.basis;
-            }
-            if (refresh === undefined && unknownKeyRefresh && cached !== undefined) {
-                bases.set(issuer, Object.freeze({ ...cached, unknownKeyRefreshedAt: observedAt }));
+            let basis;
+            try {
+                basis = await discover(issuer, fetch, signal, policy);
             }
-            if (refresh === undefined) {
-                const controller = new AbortController();
-                refresh = {
-                    controller,
-                    operation: undefined,
-                    subscribers: 0,
-                    settled: false,
-                    unknownKeyRefresh,
-                    requestedKeyIds: new Set(keyId === undefined ? [] : [keyId]),
-                };
-                const owned = refresh;
-                owned.operation = discover(issuer, fetch, controller.signal, policy)
-                    .then((basis) => {
-                    controller.signal.throwIfAborted();
-                    const refreshedAt = now();
-                    if (bases.size >= MAXIMUM_VERIFICATION_BASES && !bases.has(issuer)) {
-                        const oldest = bases.keys().next().value;
-                        if (oldest !== undefined)
-                            bases.delete(oldest);
-                    }
-                    bases.delete(issuer);
-                    bases.set(issuer, Object.freeze({
-                        basis,
-                        refreshedAt,
-                        ...(owned.unknownKeyRefresh ||
-                            [...owned.requestedKeyIds].some((requested) => !basis.keys.some((candidate) => candidate.kid === requested))
-                            ? { unknownKeyRefreshedAt: refreshedAt }
-                            : {}),
-                    }));
-                    return basis;
-                })
-                    .finally(() => {
-                    owned.settled = true;
-                    if (pending.get(issuer) === owned)
-                        pending.delete(issuer);
-                });
-                pending.set(issuer, owned);
+            catch (cause) {
+                // A failed unknown-key refresh spends the cooldown and keeps the usable basis.
+                const current = bases.get(issuer);
+                if (unknownKeyRefresh && !signal.aborted && current !== undefined) {
+                    retain(issuer, { ...current, unknownKeyRefreshedAt: observedAt });
+                }
+                throw cause;
             }
-            else if (unknownKeyRefresh) {
-                refresh.unknownKeyRefresh = true;
-            }
-            if (keyId !== undefined)
-                refresh.requestedKeyIds.add(keyId);
-            const basis = await subscribe(refresh, issuer, pending, signal);
             signal.throwIfAborted();
+            const refreshedAt = now();
+            retain(issuer, {
+                basis,
+                refreshedAt,
+                ...(unknownKeyRefresh ||
+                    (keyId !== undefined && !basis.keys.some((candidate) => candidate.kid === keyId))
+                    ? { unknownKeyRefreshedAt: refreshedAt }
+                    : {}),
+            });
             return basis;
         },
     });
@@ -116,41 +107,6 @@ export async function verifyCredential(input, audience, bases, signal, policy) {
     admitEndpoint(`${admittedIssuer.replace(/\/+$/u, '')}/invoke`, policy);
     return Object.freeze({ raw: input, verified: verified.verified, basis });
 }
-function subscribe(refresh, issuer, pending, signal) {
-    signal.throwIfAborted();
-    refresh.subscribers += 1;
-    return new Promise((resolve, reject) => {
-        let complete = false;
-        const finish = () => {
-            if (complete)
-                return false;
-            complete = true;
-            signal.removeEventListener('abort', cancel);
-            refresh.subscribers -= 1;
-            if (!refresh.settled && refresh.subscribers === 0) {
-                if (pending.get(issuer) === refresh)
-                    pending.delete(issuer);
-                refresh.controller.abort(new DOMException('Issuer discovery was cancelled.', 'AbortError'));
-            }
-            return true;
-        };
-        const cancel = () => {
-            if (!finish())
-                return;
-            reject(signal.reason);
-        };
-        signal.addEventListener('abort', cancel, { once: true });
-        refresh.operation.then((basis) => {
-            if (!finish())
-                return;
-            resolve(basis);
-        }, (cause) => {
-            if (!finish())
-                return;
-            reject(cause);
-        });
-    });
-}
 export async function verifyCredentialAgainst(input, audience, basis, preinspected) {
     let inspected;
     try {
@@ -220,21 +176,55 @@ async function discover(issuer, fetch, signal, policy) {
     });
 }
 async function request(fetch, url, signal) {
-    try {
-        const response = await fetch(url, { method: 'GET', redirect: 'error', signal });
-        if (!response.ok) {
-            await response.body?.cancel();
-            throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
+    for (let attempt = 0;; attempt += 1) {
+        signal.throwIfAborted();
+        try {
+            const response = await fetch(url, { method: 'GET', redirect: 'error', signal });
+            if (!response.ok) {
+                await response.body?.cancel();
+                throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
+            }
+            return response;
+        }
+        catch (cause) {
+            if (signal.aborted)
+                throw signal.reason;
+            if (cause instanceof IssuerUnavailable)
+                throw cause;
+            // One retry belongs to the caller's issuer load, never to its business call.
+            if (attempt !== 0 || !transientTransport(cause)) {
+                throw new IssuerUnavailable('Issuer discovery request failed.', cause);
+            }
+            await retryDelay(signal);
         }
-        return response;
     }
-    catch (cause) {
-        if (signal.aborted)
-            throw signal.reason;
-        if (cause instanceof IssuerUnavailable)
-            throw cause;
-        throw new IssuerUnavailable('Issuer discovery request failed.', cause);
+}
+function transientTransport(cause) {
+    // Node fetch wraps its transport Error; Bun may expose the code directly. Bound traversal
+    // of an external cause chain, including cycles, and do not look past a classified refusal.
+    for (let depth = 0; depth < 4; depth += 1) {
+        if (cause === null || typeof cause !== 'object')
+            return false;
+        const code = Reflect.get(cause, 'code');
+        if (typeof code === 'string')
+            return TRANSIENT_TRANSPORT_CODES.has(code);
+        cause = Reflect.get(cause, 'cause');
     }
+    return false;
+}
+function retryDelay(signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const cancel = () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', cancel);
+            resolve();
+        }, DISCOVERY_RETRY_DELAY_MS);
+        signal.addEventListener('abort', cancel, { once: true });
+    });
 }
 async function json(response, signal) {
     const bytes = new Uint8Array(await response.arrayBuffer());

package/dist/execution/index.d.ts

@@ -1,5 +1,7 @@
 export { serve } from './serve.js';
-export type { ExecutionContext, ServedApplication, ServeInput } from './serve.js';
-export { createIdentity, type ExchangeOptions, type Identity, type IdentityInput, } from './identity/index.js';
-export { InvocationError } from './invocation/index.js';
-export type { InvocationErrorCode } from './invocation/index.js';
+export type { ExecutionContext, ServedDomain, ServeInput } from './serve.js';
+export { DEFAULT_MEMORY_CACHE_ENTRIES, memoryCache, type DeploymentCache, type MemoryCacheOptions, } from './cache/index.js';
+export { createIdentity, maximumExchangeTtl, type ExchangeOptions, type Identity, type IdentityInput, } from './identity/index.js';
+export type { DurableEngine, DurableServing, DurableServingProvider } from './workflows/index.js';
+export { DURABLE_ENGINE_EXPORTS, isDurableEngine } from './workflows/options.js';
+export { isCanonicalDurableRequest } from './workflows/route.js';

package/dist/execution/index.js

@@ -1,3 +1,5 @@
 export { serve } from './serve.js';
-export { createIdentity, } from './identity/index.js';
-export { InvocationError } from './invocation/index.js';
+export { DEFAULT_MEMORY_CACHE_ENTRIES, memoryCache, } from './cache/index.js';
+export { createIdentity, maximumExchangeTtl, } from './identity/index.js';
+export { DURABLE_ENGINE_EXPORTS, isDurableEngine } from './workflows/options.js';
+export { isCanonicalDurableRequest } from './workflows/route.js';